Linux Kernel EUVD-2026-86028

Requires local access and the ability to introduce corrupted btrfs on-disk metadata - specifically a ROOT_REF or ROOT_BACKREF item whose name_len does not exactly describe the remaining item payload (empty name, over-long name, or exceeding BTRFS_NAME_LEN) - and then have that filesystem mounted and read (e.g., BTRFS_IOC_GET_SUBVOL_INFO invoked). Practically this means mounting a crafted/malicious btrfs image, which typically needs mount privilege (CAP_SYS_ADMIN) or an auto-mount/removable-media/container path. Limiting factors: not remotely reachable (AV:L), requires attacker-supplied on-disk corruption plus a specific reader/ioctl to trigger, and only affects the btrfs filesystem; unaffected kernels are those without btrfs or already patched to 6.12.111/6.18.53/7.2.

The NVD/Linux CVSS of 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) overstates real-world risk for this btrfs tree-checker hardening fix. The bug is an out-of-bounds read: ROOT_REF/ROOT_BACKREF items carry a btrfs_root_ref followed by a subvolume name, and readers trusted the on-disk name_len without bounds validation, so a corrupted item causes reads past the item and BTRFS_IOC_GET_SUBVOL_INFO copies too many bytes into a fixed-size UAPI name buffer. This is not a network-facing flaw - exploitation requires the ability to place crafted/corrupted btrfs on-disk metadata and have it mounted and read, which is why AC:L is optimistic (crafting a corrupted ROOT_REF plus triggering the specific ioctl is a deliberate, non-trivial precondition). The triple-H impact is the main inflation: the primary consequence is a bounded kernel-memory read that can leak into the userspace GET_SUBVOL_INFO buffer (genuine but limited disclosure) or crash on a bad access - full integrity/availability compromise is not demonstrated. No EPSS, no CISA KEV listing, and no public POC accompany the record, consistent with a defensively-motivated tree-checker addition rather than an exploited primitive. Priority: LOW-to-MODERATE - patch in normal cadence; not an emergency. Note the CVSS vector says AV:L which does agree with the local, filesystem-mount nature of the description.

A local attacker who can get a crafted btrfs image mounted (e.g., via removable media auto-mount, a loopback image, or a container/namespace mount path) forges a ROOT_REF or ROOT_BACKREF item whose on-disk name_len exceeds the item payload. When BTRFS_IOC_GET_SUBVOL_INFO or another reader trusts that length, the kernel reads out of bounds and can copy adjacent kernel memory into the userspace name buffer, leaking data or crashing. No public exploit identified at time of analysis; this is a tree-checker validation hardening fix.